Observations Along The Road... at Dreamwidth

I’ve been reading a lot today about the Equifax compromise, where, you, the person whose data Equifax collected, were caught with your pants down because — although you buckled the belt as you should — the manufacturer forgot to secure the buckle to belt. When you bent over to pick up that hot dog that landed on the floor — whoops, your privates, and those of 143 Million other Equifax individuals about which Equifax had data (about 44%) were put out there for all the world to see, to point at, and to laugh.

Don’t you feel embarrassed? Don’t you feel like you should lock yourself up in a dark room and hide forever?

You don’t need to. Equifax has provided a complicated checking procedure and registration approach that, ultimately, puts you in a queue for a paid year of credit monitoring, while you give up your rights to arbitration and class actions suits¹. Doesn’t that make you feel better? Oh, and that credit monitoring. I think you still need to give a credit card, so they can start billing you after the free year is over.² Still feel better? Remember, this is monitoring — it doesn’t stop anything and lets you know after the information is used. Of course, you can have confidence in Equifax that they will protect you after the breech, given how they have handled it. [ETA: Oh, and Equifax was sending people to a fake phishing site.]

¹: [Update: They later clarified this wasn’t the case, although initial language made it appear to be the case. Translation: Sloppy response to the situation; poor contingency planning.]
²: [Update: They since removed the requirement for a credit card; it was there when this article was written]

Of course, there are security folks proposing other solutions. Some suggest the easy solution of just giving everyone new, more secure, social security numbers. Alternatively, we could start using our RealID Drivers License, and have one national identity number.

More sane folks are recommending a two pronged approach that doesn’t requiring using Equifax’s protection: the most common approach is suggesting a fraud alert on your records, and paying to have a freeze to prevent new accounts. All good ideas.

As for me, I’m going to wait and see. With 143 Million pieces of data, their odds of picking me are, well, 1 in 143 million. That’s pretty small.  Plus the information has been out there for months — and with information like this, you have to use it quickly or it loses its value. Have we seen an uptick in identity theft? I haven’t heard of anything. I strongly suspect that this was a nation state, just like the OPM breach, and only select data will be used, for sophisticated spear phishing attacks. After all, why do they need to do the fraud when they can get you to unlock the door? Further, this isn’t the only attack: you’ve likely already had your information released (see this site).

Oh, and before you get scared about using the Internet, think about this: You don’t have to be an Internet user to have your information in the Equifax data. You just have to have had credit as some point in your life. The fault was with Equifax, the company you trusted to protect your data. Oh, that’s right. You didn’t choose Equifax. The fault was with Equifax, the company other companies trusted to give them accurate credit data. Equifax didn’t care about you or your credit. And neither did that little minx, Wendy*.

It is not in Equifax’s business model to protect your data: well, they’ll protect it only until they can sell it to the highest bidder. Remember the adage: If you get the service for free, you’re not the customer, you’re the product. [Translation: Equifax and other credit reporters make money by selling your data. Until their customers — the financial organizations that buy their data — demand accurate information, nothing will change. They won’t demand as long as it doesn’t cost them. They don’t pay the cost of the identity theft — you do.]

Feel better now? If not, wait I bit. I’ll be posting something this evening that will make you feel much better, even if your pants are down.

P.S.: Speaking about phishing, my favorite theatre about spam is having performances on 9/10 and 9/17. Go see it. It had Gene Spafford rolling in the aisles.

*[Paraphrasing my favorite Alton Brown quote, long since removed from his website:]

Here’s what it comes down to kids. Equifax doesn’t give a damn about you. Neither does that little minx Rachel from Card Services or any of the other icons of finance. And you know what, they’re not supposed to. They’re businesses doing what businesses do. They don’t love you. They are not going to laugh with you on your birthdays, or hold you when you’re sick and sad. They won’t be with you when you graduate, when your children are born or when you die. You will be with you and your family and friends will be with you. And, if you’re any kind of human being, you will be there for them. And you know what, you and your family and friends are supposed to watch out for you too. That’s right folks, protecting someone else’s information is an act of caring. We will always be protected best by those that care, be it ourselves or the aforementioned friends and family.

We are having our information exposed and exploited and exploited again because we have handed a basic, fundamental and intimate function of life over to corporations. We choose to value our information so little that we entrust it to strangers. We hand our lives over to big companies and then drag them to court when the deal goes bad. This is insanity.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

This is a companion lunchtime post to my previous one. Whereas that post focused on government-related areas, this posts shares some cybersecurity items of broader interest:

• Two Factor Authentication. The Verge has an interesting opinion piece on why two-factor authentication has failed us. We have a mix of approaches, some still depending on SMS even though there are significant weaknesses there. As they say: “Nearly all major web services now provide some form of two-factor authentication, but they vary greatly in how well they protect accounts. Dedicated hackers have little problem bypassing through the weaker implementations, either by intercepting codes or exploiting account-recovery systems. We talk about two-factor like aspirin — a uniform, all-purpose fix that’s straightforward to apply — but the reality is far more complex. The general framework still offers meaningful protection, but it’s time to be honest about its limits. In 2017, just having two-factor is no longer enough.”
• Backup Software. One of the best solutions for security — and a key protection against ransomware — is having backups. But Windows backup software is often hit or miss. Here’s a good review of various packages from PC World. I’ve been using an older version of their top-rated software for a few years now: I’m on Acronis True Image 2015. It backs up to the cloud without a subscription. Their newer stuff seems to have some different models, and I haven’t decided (a) if I want to upgrade, and (b) if I want to go with their subscription approach. I’ll also note that I’ve used the Paragon backup (an older version). What I didn’t like was that it grabbed every partition on the system, and did really bad space management such that your backups would fill a drive.
• Family Passwords. This week, Lastpass announced a new service: A family password manager. As they write: “Enter LastPass Families, where you can store everything from bank accounts to passports to credit cards. Your details are secure, organized the way you want, and easily shared with your spouse, kids, in-laws, and more. You can even give access to others in the event of an emergency. The family manager can quickly add and remove members to the account, making it easy to get everyone up and running.” I still need to figure out if this service (or how this service) is an improvement over multiple Lastpass accounts. They also indicate that there is a fee for the service beyond Lastpass Premium, but if I have multiple family members with LP Premium, can things somehow be combined into one account that takes into account what has been paid. Perhaps they’ll answer this post.
• Alice and Bob. I’ve always joked that when I hear the names Alice and Bob, my eyes glaze over for the crypto discussion that follows. But why Alice and Bob? What is their history? This article answers that question. It details the major events in the “lives” of Alice and Bob, from their birth in 1978 onwards.
• Erasing Data. Here’s a pretty good summary of how to erase data from both magnetic and solid state drives. File it away; it may prove useful.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

Here are some technology news chum items that have caught my eye of late:

• Acronis Backup / True Image. Finding a good backup program is hard. I know. I looked for a long time, finally setting on the Acronis product. So when I saw this article about the incorporation of blockchain verification and ransomware production in the latest version, I was intrigued. Then I received an email about a 50% off sale until July 20. But then I looked at the webpage. The 50% off sale applied only to the standalone product, which doesn’t backup to the cloud, nor incorporate the ransomware protection. For those features, I’d have to go to the yearly subscription based version. Given that Acronis 2015 is working, plus I already pay Acronis for cloud storage which the backup can save to, I’m not sure I’ll upgrade. Yet. Maybe when I go to Windows 10. Eventually. But YMMV.
• Authentication and Passwords. A number of items here. First, here’s a good reference on how to set up two-factor authentication on your accounts. It’s a good thing to do, whether that second factor is a text to your phone, Google Authenticator, LastPass Authentication, or something else you have. If you must use passwords, I always recommend a password manager, for it simplifies having complex, unique passwords for every account while you only have to remember one password. Tied to that (h/t to Andrew Ducker for this and the next link) is an interesting recommendation from the UK government to not require users to change passwords so often. Andrew also found an interesting discussion about what happens if you treat password recovery question answers like passwords (also known as: Why did you name your dog  aftoNfAyougHTEn?). Lastly, there’s an interesting blog post from LastPass on how they notify you if your email ever shows up in a password breech database.
• Firefox. It used to be that the battle was Netscape vs. IE. Nowadays, Google Chrome is the King, but it might be too power-hungry. Here are two articles on Firefox. The first explores how to enable multi-process on Firefox 54+ if it isn’t already enabled. The second gives a series of reasons why one should switch to Firefox.
• Navigation Wars. Here’s an interesting piece that compares and contrasts the main navigation apps: Google Maps, Waze, and Applie Maps. Of course, I just prefer to use real maps.
• Genealogy. For years, my genealogy program of choice has been Rootsmagic, the successor to Parson’s Family Tree Maker. They just added support for integration with Ancestry.Com.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

Continuing to clear the news chum, here are a bunch of articles all related to cybersecurity:

• NIST Cybersecurity Framework is Changing. NIST is getting ready to release an update to their Cybersecurity Framework (and other updates are planned: eventually, the IPD of 800-53rev5 will be out for review, and then an update to 800-37). A key change in the new framework is measurement: The first, which should really be the starting point for any comprehensive cyber risk management program, is an entirely new section about measuring the performance and maturity of organizations’ cyber risk programs. It also discusses the need and complexity of correlating those metrics to business objectives and outcomes. That means measuring both how organizations are reducing risk to the business and identifying the benefits to the business resulting from good cybersecurity, such as how many new customers the organization has gained and/or how much more revenue was brought in. Another significant change in the framework is the addition of recommendations surrounding supply-chain risk management. Finally, the access-control category has changed within the framework. It was renamed to identity management and access control. The change adds more focus on making sure identities and credentials are managed from the time they are created to the time they are deactivated.
• Minimal Cybersecurity Requirements. Although some of us have known about this for a while, the world is growing increasingly aware of NIST SP 800-171. The new mandates take effect Dec. 31 this year and apply to contractors for the Department of Defense, National Aeronautics and Space Administration (NASA) and the General Services Administration. While some manufacturers are accustomed to working with federal agencies on classified projects, these regulations are meant to safeguard sensitive information in unclassified material, particularly as the threat of cybersecurity breaches grows.  Basically, they apply to any federal contractor that handles what is called Controlled Unclassified Information.
• Encryption and Protection. Protection is good. Just ask porn site Pornhub, home to things like thumbzilla and youporn. They’ve gone to always on encryption, meaning that although your ISP knows you’re going to pornhub, they don’t know what you’re looking at. Others are turning to VPNs, and here’s a good summary of how to use one.  Lastly, for those worried about your ISP seeing where you go, one thing you should do is not use the ISP’s DNS. I use openDNS: 208.67.222.222 and 208.67.220.220.
• Verizon and Spyware. Note that if you use Verizon Wireless, they may be pre-installing spyware on your phone.
• JavaScript Popups. Google is making some changes to eliminate those popup dialogs that don’t let you leave. Such popups are occasionally useful as alerts, but their fix sounds reasonable.
• Congrats to North Hollywood High. They won a national cybersecurity competition. Disclosure: My employer helped sponsor the team, although I was not involved.
• Printer Cartridges. Lastly, an interesting court case that could dictate how much you pay for ink. This week, oral arguments were heard in the case of Impression Products, Inc. v. Lexmark International, Inc., and according to the well-regarded SCOTUSblog, it seems that the justices are having a tough time figuring out how to view this difficult legal tangle themselves. At its most basic, the case is a dispute over Lexmark’s patent rights regarding refilling printer cartridges. Impression Products is a small business with about 25 employees. It specializes in buying used printer cartridges and re-manufacturing them. In 2012, Lexmark decided to add Impression to an already existing lawsuit against other re-manufacturers. While the other defendants eventually settled, Impressin has stuck it out and the case has made it to the highest court in the land. The question is: Does the manufacturer give up rights to something when you physically purchase it? Can Lexmark dictate what you can do with your printer cartridge? Can HP dictate you can’t open your computer and modify it? Big key questions.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

If you’ve been following the technical news the last few days, I’m sure you’ve seen the articles about the vulnerabilities discovered in Lastpass (a popular password manager, and one that I use). You may have even seen people complaining that Lastpass was slow to fix vulnerabilities and that one shouldn’t use browser extensions and such. To me (someone who works in cybersecurity), this demonstrates yet again that most people have no idea at all how to assess risk.

This is a great example of this. The vulnerabilities announced above depend on visiting a malicious website. Think about the websites you visit on any given day. The vast majority are probably from some small set of the same sites: social media, news sites, banks, well-known shopping sites, perhaps well-known games. All with low odds of being malicious. Your only exposure might be if you click on an ad (most of us don’t do that) or click on an unknown link in an email (your mother taught you better). So, for the vast majority of people, the odds of going to a malicious website that has a newly released vulnerability that targets a specific password manager is low. Although you may see FUD (fear, uncertainty, distrust) otherwise, such as this statement on the Lastpass forums:

You mentioned exposure. There is always the possibility that someone discovered the bug previously, harvested the information and is sitting on it. Due to the nature of LastPass the level of the compromise is greater than any other tool or device as it would provide information to all passwords (as I understand it), not merely a matter of changing the password to your email or facebook account but could consist of updating 100’s of passwords. That 2FA appears to have been side stepped by this compromise is a large worry.

(2FA refers to two-factor authentication). Let’s assume, as this author did, that someone discovered the bug previously, harvested the info, and is sitting on it. Exploitation still requires visiting a malicious website, and it having a targeted attack in place. From the Lastpass blog on the subject:

To exploit the reported vulnerabilities, an attacker would first lure a user to a malicious website. Once on a malicious website, Tavis demonstrated how an attacker could make calls into LastPass APIs, or in some cases run arbitrary code, while appearing as a trusted party. Doing so would allow the attacker to potentially retrieve and expose information from the LastPass account, such as user’s login credentials.

Based on this description, they wouldn’t even be obtaining all passwords. They would have to do so one at a time. If you practice good security hygiene and enable 2FA whereever you can (not just Lastpass), even if you did visit a malicious website, and even if they had a targeted attack, and even if they guessed one account right, 2FA would defeat them on that account, or you would have noticed something.  In other words, low odds of it being exploited.

As for the time to correct the problem, Lastpass had updated extensions in place (which auto-update) within 24 hours. The researcher that identified the vulnerability even acknowledged as much in this updated article (scroll to the bottom). We’ve gotten used to reported Windows vulnerabilities — which might be in the wild — being corrected in a month if we’re lucky. Similarly for Flash vulnerabilities. Both see much greater use, and much greater exposure. Here you had reasonably rapid correction of a bug.

Tavis Ormandy @taviso : Two more LastPass bugs fixed today https://bugs.chromium.org/p/project-zero/issues/detail?id=1188 … and https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 …. Very quick response from LastPass, < 24hr.

Tavis Ormandy @taviso : Very impressed with how fast @LastPass responds to vulnerability reports. If only all vendors were this responsive

Lastly, there are folks out there that believe software should be bug-free. Programmers believe that as well, but recognize it is an impossibility. Turing Award Winner C.A.R. Hoare said it best:

There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. It demands the same skill, devotion, insight, and even inspiration as the discovery of the simple physical laws which underlie the complex phenomena of nature.

Dahl, Dykstra, and Hoare, back in 1972, also noted that provably bug-free software is impossible: “Program testing can be used to show the presence of bugs, but never to show their absence.” We should expect our software to continue to have bugs, perhaps becoming more esoteric and harder to exploit as time goes on, but there none-the-less. All we can ask then is rapid patching.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

Password. The security mechanism we love to hate. Or hate to love. Or grudgingly tolerate. In any case, if you use passwords, you know you are encourage to (a) enable dual factor authentication whenever and where ever possible; (b) use the strongest passwords possible; and (c) use a unique password on every site. For (b) and (c), the easiest way to do this is to use a password manager (I use Lastpass), and have it generate strong passwords for sites (I have it generate long pronounceable passwords, and then modify them with digits and special characters). That still, of course, means you need a strong password for the password manager.

Many years ago, in the days of Dockmaster, there was a generator that would generate strong, prounceable passwords. For a few years I used those, then I went to grabbing words from various places and combining them to create master passwords. Yesterday, I found another solution. Here is a site that generates nonsense words based on a frequency list of phonemes as they occur in legitimate English words.  You should be able to get strong master passwords by combining words and making permutations to add special characters, digits, capitalization, etc.

Here is an example of some generated words: minating ocrates exishering hophish diuraggramely tilized middly apissong moratierencess antinumeted fances vaultanewns gunfins ineake snaphypong misplake quarout hightfulus ansprubblet midweir objecta steton lishep ratinessy mententes.

Hopefully, you’ll find this useful.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

As you have probably figured out by now, I accumulate articles of interest as I wander the web, and periodically collect them into themed articles.Today is no exception, and our topic for today is cybersecurity — specifically, whether anyone is safe online (or is it just an illusion), and how to really make the situation better.

• Foreign Actors. In recent weeks, a big question has been whether Russia hacked the US — particularly, the DNC and RNC. Donald Trump, in his news conference today, finally admitted that it was likely Russia did, but that other countries could as well. What is the basis for the belief that Russia was behind things? Brian Krebs, in an article written before the CIA report was released, has a very good analysis. Krebs notes, “It probably doesn’t matter how many indicators of compromise and digital fingerprints the Obama administration releases on this incident: Chances are decent that if you asked a panel of security experts a year from now whether the march of time and additional data points released or leaked in the interim have influenced their opinion, you’ll find them just as evenly divided as they are today.” This is because providing strong attribution is difficult, short of your hacker being stupid, just because of the nature of Internet communications. The article points out that there are specific breadcrumbs that lead to the conclusion, and notes why the public has become skeptical. Of everything. I suggest you read that analysis, and then think about it in light of the BBC disclosure that there are unconfirmed reports that Russia has something on Trump. Ask yourself: If the Russians hacked the DNC, why did they want Trump to win (this is not to say they manipulated the election to do so)? Could it be that they didn’t need to worry about him for other reasons?
• Data Breaches. Brian also has a really good article on data breeches, and in particular, some immutable truths about such breaches. He explains them in more detail in the article, but here they are in a nutshell: “(•) If you connect it to the Internet, someone will try to hack it. (•) If what you put on the Internet has value, someone will invest time and effort to steal it. (•) Even if what is stolen does not have immediate value to the thief, he can easily find buyers for it. (•) The price he secures for it will almost certainly be a tiny slice of its true worth to the victim. (•) Organizations and individuals unwilling to spend a small fraction of what those assets are worth to secure them against cybercrooks can expect to eventually be relieved of said assets.” First, think about this with respect to the above. Both the DNC and RNC had servers on the Internet. Were they hacked? Most certainly. What was that information worth? Ask Hillary Clinton. Now, you deal with banks and businesses that put your information on the Internet. Now think about the truisms above.  Which organizations should you deal with? How much do they value your information?
• Online Shopping. Dovetailing with all of this is an article from my web hosting service, Webhost, on what to be aware of when you shop online. They, too, go into a bit of detail, but their tips boil down to: (•) Shop online at home (or on a secure connection); (•) Make sure you have text, email, and/or phone security alerts set up with your financial institutions; (•) Always look for HTTPS when shopping; (•) If you’re shopping through a retailer’s mobile app, make sure it is an official version with a reputable company or developer behind it; (•) Use the ‘too good to be true’ rule and trust your gut. I’d add to this the adage to stay in a well-lit well populated part of the Internet. By that I mean: use companies that have a reputation to uphold — they are more likely to do things right.
• Solving the Problem. The underlying problem for all of the above is that we are using a system that was never meant to be secure. That’s right: the basic and original protocols didn’t think about security because they believed everyone was trustworthy. The corollary to this is: if you want a secure system, you must engineer the security in from the start. Related to this, NIST has just announce a system security engineering website, based on their work with NIST SP 800-160. I’ve been doing a lot of close work with 800-160, and am working on gaining a deep understanding on it, and well as how all of the related processes (assessment, acquisition, and lifecycle) can work together. But 800-160 is a good start.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

A number of people I know refuse to vote for Hillary because they believe she mishandled classified information, and that the FBI was wrong in not prosecuting her. I’d like to convince them otherwise. So let’s do some reasoning, shall we?

We are talking about email here. What is a unique characteristic of email? It has a sender and a receiver. Suppose you are friends with Jared Fogle, the Subway guy. He decides to send you an email with one of his favorite pictures of children attached. It arrives in your server, unsolicited. Are you guilty of possession of child pornography? Even if you delete it when you receive it? It’s a serious question. I was once at a security conference where someone said one of the best attacks in the world is to go to a conference room computer, load child porn from a thumb drive onto that computer, and then delete it… and then report the person for possessing child porn. Look, he even knew he was guilty when he deleted it, right?

Wrong. The criminal is the person that loaded the illegal material, not the recipient.

The same rules apply with classified information. If someone emails you a classified document over an unclassified system, the person who is in big trouble is the person who originated that document (i.e., took content they knew was classified and entered it into an unclassified system) in the first place. The person who receives it is suppose to recognize and report it (although that doesn’t always happen), and their computer is appropriately cleaned (often with only a minor warning to them, because it wasn’t their fault).

Think about what you know about Hillary’s server. The messages that were found were sent to her; she didn’t originate them. At worst (and this is a supposition), she inadvertently forwarded them because they were not marked properly (plus who would send her classified info on a public computer).

But, you say, people have been prosecuted for having classified information on unclassified computers. Yup. But look at those cases closely: they put that information on those systems, often with the intent to exfiltrate it to an unauthorized party. In fact, espionage laws requires that intent to be present, and provably present. I have not seen any articles that demonstrated that Secretary Clinton took a document she knew was classified, put it on her email server, and sent it to someone else with the explicit intent to exfiltrate it. That is why the FBI did not prosecute her, even though there was classified information found.

But, you say, she sent messages with classified information. Other than possibly inadvertent forwarding, my understanding of those incidents is that the information was not classified at the time it was sent; it was classified sometime later. In these cases, what matters is the classification at the time it was sent. Subsequent classification does not expose anything because there is nothing that indicates the original message was confirmed as classified information. It has the same status of classified information published by Wikileaks in the New York Times — if you don’t know it is classified, it has no authority.

Again, there is no evidence (and remember: one is innocent until proven guilty) that Secretary Clinton took information from a marked, classified document, and then entered that information onto her server with the intent to exfiltrate it. That is the crime.

If your sole reason for voting against Hillary is that you believe she mishandled classified information, then I suggest you change your mind. Secretary Clinton — as demonstrated by her debate behavior — is some that always thinks before she speaks and is always prepared. She knows what is classified, and does not discuss it publicly (unlike Donald Trump, who has disclosed some of his intelligence briefings). She is cautious in how she words things and says things; again, a behavior we have not seen in Mr. Trump). Secretary Clinton cannot control what people send her, and whether they mark it correctly. Her only infraction here is not recognizing mis-marked information and reporting it (for she has already acknowledged the mistake of having the private server in the first place, and indicated she would not do it again… and at the time she did it, private servers were permitted for unclassified information).

ETA 10/25/16: My friend Rick Smith over at Cryptosmith has a great article on this subject. Reading it, another cybersecurity colleague, Dave Bell, wrote: “This is a nice exegesis of the laws and regulations surrounding classified information in general and classified email in particular. Lapses in following Department rules on disclosure are not ILLEGAL (in the sense of violating laws) unless the information is covered by the Espionage Act (circa WWI) or the Atomic Energy Act of 1946. The article points to a more detailed, lawyerly article.”

Lastly, you’ll say, she deleted all this email. That make her guilty of something, right? Nope. In America, absence of evidence does not imply guilt. The courts require that guilt be proven beyond a reasonable doubt, and there is a presumption of innocence. Just as Mr. Trump is not guilty of all the sexual assault claims until he has his day in court, and the actual evidence presented and a jury convinced, Secretary Clinton is innocent until there is actual evidence of a crime with a conviction. One cannot have the standards be different for some citizens.

So, let’s drop the whole canard about Hillary’s emails. It is up there in the meaningless category with the canard that she is responsible for her husband’s infidelities. Ah, but you say, if that’s a canard than Trump’s behavior is a canard. Potentially, you’re right. Nothing has been proven yet in court. He is only accused, and not proven guilty. He’s as pure as Bill Cosby. Yet words do demonstrate attitude, and he is on record for what he has said, and has not (a) apologized for the words, and (b) changed the behavior. Contrast this with Bill Clinton — there has been no evidence that his behavior has been repeated since the incidents in the 1990s.

Share/Bookmark

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

Although you’re probably still wondering why an article written in Spring 1995 seems so eerily accurate about Donald Trump today, I’d like to give you some more things that you probably haven’t thought about:

• Gases and the Body. You’ve probably become more and more aware of the microbiome in our bodies. You probably haven’t given a lot of thought to the gasses in our bodies, except when they escape from ends of the digestive track. However, a new study shows how the gases swirling inside our bodies can power our brains and affect the way we act. Some gaseous neurotransmitters (or gasotransmitters) are produced by your organs and tissues. Others—such as nitric oxide (NO), carbon monoxide (CO), hydrogen sulfide (H₂S), methane (CH₄), hydrogen (H₂), and ammonia (NH₃)—are the products of fermentation in your gut by microscopic organisms like bacteria. These tiny molecules feed and help regulate your cells and those of the microbes living inside you—complex relationships that can have much larger consequences. An interesting addendum: biological processes can also be harnessed to turn Carbon Dioxide into a fuel.
• Drywall. It know, it sounds like something out of Surprisingly Awesome: The exciting history of drywall (gypsum board). Gypsum is noncombustible, and compared to other wall materials, like solid wood and plaster, gypsum boards are much lighter and cheaper. As a result, drywall is popular in homes across the U.S.: According to the Gypsum Association, more than 20 billion square feet of drywall is manufactured each year in North America. It’s the staple of a billion-dollar construction industry that depends on quick demolition and building. It can also be deadly.
• Architectural Security. Have you ever closely looked at the architectural characteristics when you are out and about. It turns out that many of them exist to enhance security. “The inside of a building in it of itself can be a security tool,” says Geoff Manaugh, an architecture writer and blogger of BLDGBLOG. “If you don’t think about buildings in terms of security and you don’t think of architecture in terms of burglary, you can really easily overlook these things.”
• The Most Cost Effective Pizza. Due to the nature of geometric math, the larger pizza is almost always the most cost effective pizza. Just remember to refrigerate the leftovers. The math of why bigger pizzas are such a good deal is simple: A pizza is a circle, and the area of a circle increases with the square of the radius.
• Embedded Links. Much as you try not to do it, a determined hacker can design a link such that almost anyone will likely click on it. Human traits like curiosity “cannot be patched” against these kinds of vulnerabilities, says one leading computer science researcher. And so, you can be the smartest security buff in the world, yet researchers could probably still trick you into clicking on a dangerous link.

Share/Bookmark

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

I’m still working on clearing out the links that accumulated during the Hollywood Fringe Festival (FB), with a goal of getting them all done before you take off for the Fourth of July weekend. I may already be too late. Here’s a chunk that are loosely related to science, medicine, and technology:

Medicine Chum

• Understanding Migraines. One of the ills that plague me are migraines (which, luckily for me, are mild compared to what others get). No one knows precisely what triggers migraines, or how the various abortives work. Some think it is related to nerves in the head, and some think it is related to blood flow.  A new genome-wide association study published in Nature Genetics suggests that a migraine may primarily stem from problems with the blood supply system. This could lead to new ways to treat migraines.
• More Than Human. We’re discovering more and more than the human organism is much more than the human organism — that is, much of what contributes to our health or lack thereof is our microbiome. Further, our overfocus on being “germ-free” has significantly hurt our biome, and may be the single largest contributor to our various health maladies — including obesity. Here’s another biome story — this time, the involvement of the biome with what has been called Chronic Fatigue Syndrome. Specifcally, researchers say they’ve found biological markers of the illness in the blood and gut bacteria of people with systemic exertional intolerance disease (SEID) (a/k/a CFS). Their results were published in the journal Microbiome. In this study, found clear differences between the blood and guts of healthy versus sick people. Compared to healthy controls, people with ME/CFS had weaker and less diverse bacterial ecosystems in their guts, as well as higher levels of immune inflammation in their blood. These differences were so clear that the researchers were able to spot nearly 83 percent of the time which participants had ME/CFS just by looking at their bacterial and immune response results.
• Being Like Everyone Else. If everyone else did something with no proven medical benefit for medical reasons (like, for example, overusing bacterial soap), would you do it? A study that is unsurprisingly proving very viral on social networks is highlighting one such thing: most women these days are “preparing for the Olympics” for claimed medical benefit, when there is none (where “preparing for the Olympics” == “going Brazilian” == removing hair on their … == insert your own euphemism here). My attitude, for whatever it is worth, is that women are their most beautiful when they look like women — not airbrushed models or pre-pubescent girls — but women – with imperfections and hair and some parts large and some parts small and some parts inbetween. While we’re on that subject (and while we’re clearing links), here’s an article I found on two-piece suits for large chested ladies. What bothered me about that article is that the chest was the only part that was large. Why weren’t there two-pieces for ladies who happened to be large in other places as well? As it is, an article like that is just perpetuating body dismorphic ideas, just like shaving everywhere does.
• How Old is Your Body? I’m 56. Recently, I’ve been wondering if there is any part of my body that has been with me all 56 years. So I was quite pleased to see an article come across my feeds that asked the same question: How old is your body? What component of your body has been around the longest time? For example: brand new fingernails every six months, 2-7 years for the hair on our heads, new skeletal muscles every 15 years. But those neurons in your brain? Never replaced.

Technology Chum

• Automotive Security. We were having a discussion on our van this morning about car security, specifically how some thieves are collecting automotive RFID signals, and then going around parking lots broadcasting them, unlocking cars, and stealing stuff inside. I had noted how cars are generally better protected against theft, and how entertainment units are less likely to be stolen than radios of old. Another rider pointed out, however, that the keyless ignition cars are easier to steal. In general, our cars are weak in terms of security — so it is good at the Senator is pushing to increase cybersecurity protections in cars.
• LED Streetlight Dangers. More and more cities are going to LED streetlights because they use less energy and are brighter. Now the AMA has come out with some cautions on LED lighting: cool it and dim it. The AMA’s statement recommends that outdoor lighting at night, particularly street lighting, should have a color temperature of no greater than 3000 Kelvin (K). Color temperature (CT) is a measure of the spectral content of light from a source; how much blue, green, yellow and red there is in it. A higher CT rating generally means greater blue content, and the whiter the light appears. The new “white” LED street lighting which is rapidly being retrofitted in cities throughout the country has two problems, according to the AMA. The first is discomfort and glare. Because LED light is so concentrated and has high blue content, it can cause severe glare, resulting in pupillary constriction in the eyes. Blue light scatters more in the human eye than the longer wavelengths of yellow and red, and sufficient levels can damage the retina. This can cause problems seeing clearly for safe driving or walking at night. It can also affect our sleep cycles and rhythms (which is why many people recommend using f.lux to turn down the blue on your screens in the evening).
• Tweaking Your Facebook Feed. Many of us who came from LJ miss the days of a sequential feed, where you know you could catch up on your friends. Facebook has never been quite the same. But Facebook is now providing some details on how to tweak your feed. First, they’ve disclosed their news feed algorithm, which will now show posts from friends higher up in the feed than posts from Pages like news outlets. Based on these new values, there are now some specific tweaks that you can do to make your newsfeed what you want it to be.

Science Chum

• Lift Me Up. You might have heard about the helium shortage. That shortage may be going away, as scientists have discovered new Helium resources, and new ways to extract it. That’s good news, as helium is a vital nobel gas (used in much more than balloons), and there is not an easy way to make more.
• Drill Me Down. Scientists also believe they have found new water supplies in the central valley of California, albeit at a deeper depth and with greater salinity. Will this solve California’s drought? I doubt it.

Science People In the News

• New Position: Steve Isakowitz. The Aerospace Corporation (my employer) has announced the selection of a new corporate President and soon-to-be CEO: Steve Isakowitz, former President of Virgin Galactic. Iskowitz is also a former CTO of Virgin Galactic. Previously, he held a wide variety of senior engineering, business, and management roles across the private and government sectors, including positions at NASA, the Office of Management and Budget, the Intelligence Community, and the Department of Energy. He replaces Wanda Austin, who has reached the corporate age limit for VPs and above.
• Passing: Simon Ramo. Simon Ramo, the “R” in TRW, has passed away.  Ramo shaped California aerospace and the space industry through organizations like TRW, and I should note that he is responsible for the company I work at: The Aerospace Corporation is actually an FFRDC spin-off of STL, Space Technology Laboratories, which went on to become TRW.
• Passing: Steve Walker. Word came to me Thursday morning of the passing of Steve Walker, one of the seminal people in the field of cybersecurity. The formal obituary and funeral arrangements haven’t been published; I found a bio here. We’ll get something up on the ACSA In Memorium page as soon as we can.

Share/Bookmark

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)